PT-2015-1975 · Django Software Foundation+2 · Django+2

Lin Hua Cheng · Published 2015-08-18 · Updated 2022-05-17 · CVE-2015-5964

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.21 Django versions 1.7.x through 1.7.9

Description The issue is related to errors in resource management in the contrib.sessions.backends.base.SessionBase.flush and cache db.SessionStore.flush functions of the Django framework. This can be exploited by a remote attacker to cause a denial of service under certain conditions. The exploitation allows attackers to consume session store resources, leading to a denial of service.

Recommendations For Django versions 1.4.x through 1.4.21, update to version 1.4.22 or later. For Django versions 1.7.x through 1.7.9, update to version 1.7.10 or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1872

BDU:2015-11321

CVE-2015-5964

DLA-301-1

DSA-3338-1

GHSA-X38M-486C-2WR9

MGASA-2015-0327

PYSEC-2015-23

RHSA-2015:1766

RHSA-2015:1767

RHSA-2015:1894

USN-2720-1

Affected Products

Alt Linux

Django

Ubuntu

References · 36

• http://rhn.redhat.com/errata/RHSA-2015-1767.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2720-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1766.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1894.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5964 · Vendor Advisory
• http://ubuntu.com/usn/USN-2720-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x38m-486c-2wr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5964 · Security Note
• https://osv.dev/vulnerability/CVE-2015-5964 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0327.html · Security Note
• https://osv.dev/vulnerability/PYSEC-2015-23 · Vendor Advisory
• https://djangoproject.com/weblog/2015/aug/18/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0327 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2720-1 · Vendor Advisory